Exam PCNSA topic 1 question 360 discussion

Another thing that conflicts (at least this is what I think), I suggested going with C, however in the question is does mention customized privileges, which I believe would mean the role should be set to 'Role Based'. https://docs.paloaltonetworks.com/panorama/11-0/panorama-admin/panorama-overview/role-based-access-control/administrative-roles So realistically the answer would really be: - Select the User Only client certificate - Set Role to 'Role Based - Issue Client cert "New_Admin"

I believe the answer here is C, in the video I can see the role is set to 'Dynamic' and they specifically say the Common Name must match the user id (case sensitive).

C This setup ensures that the new administrator named New_Admin can authenticate using a client certificate without needing to enter a username or password. The "Dynamic" role setting allows the profile to be matched based on the certificate's Common Name.

D seems correct. Spaces are allowed in common name, according to RFC 7468. I guess ._.

Soooo many holes in this question.... 1) Common name is an IP or FQDN, not something like New Admin 2) Certificate Name cannot have spaces That alone takes out B, C and D... A doesn't seem right either though given the context of the question. There has to be a certificate loaded on the client machine in order to do what the question is asking.

A is the answer https://docs.paloaltonetworks.com/pan-os/10-1/pan-os-admin/firewall-administration/manage-firewall-administrators/administrative-authentication